It is an introduction to MongoDB security and why MongoDB security important. How to secure your mongodb system. Let's discuss in deep with examples.

1. SECURITY
Monika Mathur
FullStack Developer
Habilelabs.io

2. CONTENTS
1. Introduction MongoDB security
2. Why mongoDB security important
3. How to secure your mongodb

3. SECURITY

4. Niall Merrigan, security researcher and
Microsoft developer based in norway, has
been tracking the mongodb ransom
incidents, and in one day, he saw
the number of attacks more than double
from 12,000 to 27,633.
SECURITY ATTACKS

5. Attackers have been accessing databases,
copying files, deleting everything and
leaving a ransom note promising the
return of the data for a fee.
WHAT HACKER DO WITH DATABASES

6. SECURE YOUR DATABASE

7. REFERENCE ARCHITECTURE
Clients
Storage
Administrators
Authentication Authorization Auditing Encryption

8. AUTHENTICATION
Clients
Storage
Administrators
Authentication Authorization Auditing Encryption
Which users/apps
are accessing the
DB
Which nodes
are joining
the cluster
Which users
are accessing
the DB

9. AUTHENTICATION MECHANISM
Client/User Auth
• SCRAM-SHA-1
• MONGODB-CR
• X.509
• LDAP
• Kerberos
Internal Auth
• Keyfile (SCRAM-SHA-1)
• X.509

10. AUTHENTICATION MECHANISM
SCARAM-SHA-1
MONGODB-CR
X.509
LDAP
Kerberos
Community

11. AUTHORIZATION
Clients
Storage
Administrators
Authentication Authorization Auditing Encryption
What
permissions
does an App
have?
What
permissions
does an
Admin have?
What data can
a user see?
What data can
an admin see?

12. WHY ROLE BASE ACCESS CONTROL

13. BUILT IN ROLES

14. USER-DEFINED ROLES

15. ACTIONS

16. RESOURCES

17. AUDITING
Clients
Storage
Administrators
Authentication Authorization Auditing Encryption
Who made
which changes
and when?
Who made
which changes
and when?

18. AUDITING
1. Add accountability
2. Investigate suspicious activity
3. Monitor database activity

19. AUDITING

20. ENCRYPTION
Clients
Storage
Administrators
Authentication Authorization Auditing Encryption
SSL
Encryption
SSL
Encryption
File system
Encryption

21. ENCRYPTION TYPE
1. Transport Encryption
2. Encryption at rest

22. TRANSPORT ENCRYPTION

23. ENCRYPTION AT REST

24. Thank You

25. CONTACT US
• Development Center :
Habilelabs Pvt. Ltd.
4th Floor, I.G.M. Senior Secondary Public School Campus,
Sec-93 Agarwal Farm, Mansarovar, Jaipur(Raj.) – 302020
• Email : info@Habilelabs.io
• Web : https://habilelabs.io
• Telephone: +91-9828247415 / +91-9887992695